Knowledge Management

Conditional SPL

japger_splunk
Splunk Employee
Splunk Employee

How do you build a query that takes two different SPL paths based on a condition within the data? Example: Write the results of a query to a summary index only if the search name does not begin with "TEST"?

0 Karma
1 Solution

japger_splunk
Splunk Employee
Splunk Employee

Use multireport to steer your search down the desired path.

| makeresults 1
|eval search_name="TEST-RiskRule - DDNS Activity Detected - System"
|multireport [|search NOT search_name="TEST*"|collect index=myindex] [|search search_name="TEST*"|collect index=myindex testmode=true]

View solution in original post

0 Karma

lakshman239
SplunkTrust
SplunkTrust

if you have a summary generating search with search_name!=TEST* will that not work for you?

0 Karma

japger_splunk
Splunk Employee
Splunk Employee

Good point. I believe your example is a one-way condition but please correct me if I misunderstand. "Only do this if this condition is met" versus "Do this if it's met or do this if it's not met".

0 Karma

lakshman239
SplunkTrust
SplunkTrust

I normally prefer to write "only do this if this condition is met", so I know the condition/scenario of the search and helps in troubleshooting.

0 Karma

japger_splunk
Splunk Employee
Splunk Employee

Use multireport to steer your search down the desired path.

| makeresults 1
|eval search_name="TEST-RiskRule - DDNS Activity Detected - System"
|multireport [|search NOT search_name="TEST*"|collect index=myindex] [|search search_name="TEST*"|collect index=myindex testmode=true]

0 Karma